{"id":368,"date":"2014-03-27T12:28:22","date_gmt":"2014-03-27T11:28:22","guid":{"rendered":"http:\/\/www.cbits.co.uk\/ourblog\/?p=368"},"modified":"2014-04-01T15:55:35","modified_gmt":"2014-04-01T14:55:35","slug":"cryptolocker-or-how-outlaws-rule-and-sheriffs-are-absent","status":"publish","type":"post","link":"https:\/\/cbits.co.uk\/ourblog\/index.php\/virusmalware\/cryptolocker-or-how-outlaws-rule-and-sheriffs-are-absent\/","title":{"rendered":"Cryptolocker (or how Outlaws rule and Sheriffs are absent)"},"content":{"rendered":"

What to do if you see this screen on you computer !<\/h2>\n

\"cryptolocker<\/h2>\n
    \n
  1. Disconnect Power from the Computer IMMEDIATELY
    \n<\/span>If it’s mains pull the plug, if its a laptop hold down the power until it shuts off<\/li>\n
  2. Disconnect from the internet (simply unplug your router from Phone line and power)<\/span><\/li>\n
  3. Shut down any other PC’s (including Macs) in the premises<\/span><\/li>\n
  4. Call Us – 0844 504 2986<\/span><\/li>\n<\/ol>\n

    Do this immediately and do not turn anything back on until you have spoken to us!<\/span><\/h1>\n

    Why \u00a0??<\/h2>\n

    You have Cryptolocker Malware<\/strong>, and it is busy irreversibly locking<\/strong> <\/em>your documents, photo’s etc \u00a0(the only way you might, – and we mean might, – get any data back is to pay a ransom of around \u20ac300 (nearly \u00a3300) in Bitcoin<\/strong><\/em> within 72 hours – we recommend you do not go there!)<\/p>\n

    What Is CryptoLocker ?<\/h2>\n
    \u00a0(info drawn for various websites and our own experience)<\/h5>\n

    CryptoLocker<\/a>\u00a0is a piece of malware targeting computers running the Microsoft Windows operating system. It is typically spread as an email attachment, often purporting to be from a legitimate source (including Intuit and Companies House). Some say it is also being spread through the ZeuS botnet.<\/h4>\n

    Once installed on your computer, it systematically encrypts all documents that are stored on your local computer, as well as ones that are stored on mapped network drives and mounted removable storage\u00a0<\/strong>.(this includes USB drives and drives on connected computers – inc Macs)<\/p>\n

    “The encryption used is strong, 2048 bit RSA, with the decryption key for your files being stored on a remote server. The odds of you being able to break this encryption is almost nonexistent. If you want to get your files back, CryptoLocker asks for you to fork over some cash; either twobitcoins<\/a>\u00a0(At the time of writing, worth almost USD $380) or $300 in either MonkeyPak or Ukash prepaid cards. If you don\u2019t pay within three days, the decryption key is deleted and you lose access to your files forever.”<\/p>\n

    The best “in detail” article we have found is here:
    \n\u00a0<\/span>http:\/\/www.bleepingcomputer.com\/virus-removal\/cryptolocker-ransomware-information<\/span><\/strong><\/span><\/p>\n

    ##########################<\/p>\n

    In contrast, CryptoLocker is very easy to deal with\u00a0IF<\/strong>\u00a0you are making frequent backups. Here is what you must do\u00a0NOW<\/strong>\u00a0to prevent future CryptoLocker problems:<\/p>\n

      \n
    1. Make sure you are making frequent backups, starting NOW, before your computer becomes infected with the \u201cCryptoLocker\u201d problem. Everyone should do that all the time anyway. Ideally, you should be using some backup program that automatically makes backups every few hours. Only use a backup program that saves ALL VERSIONS of all files. Not all backup programs do that. There are a dozen or more such programs to choose from.<\/li>\n
    2. When you get the CryptoLocker problem, please call us first! you can (in theory) use most up-to-date anti-virus program to delete it. Almost all of today\u2019s Windows anti-virus programs will do that but they probably<\/del> will not restore access to your files!<\/li>\n
    3. Restore those files from your most recent backup. You will be back in business.<\/li>\n<\/ol>\n

      Of course, if you don\u2019t make frequent backups before CryptoLocker strikes, you will have problems. Big problems.<\/p>\n

      ########################<\/p>\n

      From Wikepedia:<\/p>\n

      In December 2013,\u00a0ZDNet<\/a>\u00a0traced four Bitcoin addresses posted by users who had been infected by CryptoLocker, in an attempt to gauge the operators’ earnings. The four addresses showed movement of 41,928 BTC between October 15 and December 18, a value of about $27,000,000 USD per the exchange rate at that point in time.
      \n<\/a><\/sup><\/p>\n

      A survey by researchers at the\u00a0University of Kent<\/a>\u00a0found that 41% of UK respondents who were Cryptolocker victims claimed to have agreed to pay the ransom, a figure much larger than expected; 3% had been conjectured by Symantec, and 0.4% by Dell SecureWorks.The average amount per infection in the U.S. is $300.
      \n<\/a><\/sup><\/p>\n

      ######################<\/p>\n

      \u00a0This article is unfinshed but as we have just had a second instance of this within 24 hours I am posting it first and finalising it later<\/span><\/h2>\n

       <\/p>\n","protected":false},"excerpt":{"rendered":"

      What to do if you see this screen on you computer ! Disconnect Power from the Computer IMMEDIATELY If it’s mains pull the plug, if its a laptop hold down the power until it shuts off Disconnect from the internet (simply unplug your router from Phone line and power) Shut down any other PC’s (including […] Read more »<\/a><\/p>\n","protected":false},"author":10,"featured_media":374,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"twitterCardType":"","cardImageID":0,"cardImage":"","cardTitle":"","cardDesc":"","cardImageAlt":"","cardPlayer":"","cardPlayerWidth":0,"cardPlayerHeight":0,"cardPlayerStream":"","cardPlayerCodec":"","_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[73,60],"tags":[81,121,123,55,122,33,36],"class_list":["post-368","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-on-line","category-virusmalware","tag-beware","tag-cryptolocker","tag-help","tag-malware","tag-ransomware","tag-security","tag-virus"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4tvbq-5W","jetpack_featured_media_url":"https:\/\/cbits.co.uk\/ourblog\/wp-content\/uploads\/2014\/03\/cryptolocker-example.png","_links":{"self":[{"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/posts\/368","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/comments?post=368"}],"version-history":[{"count":7,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/posts\/368\/revisions"}],"predecessor-version":[{"id":377,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/posts\/368\/revisions\/377"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/media\/374"}],"wp:attachment":[{"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/media?parent=368"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/categories?post=368"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/tags?post=368"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}